---
id: "CVE-2026-121600"
kind: "vulnerability"
aliases: ["CVE-2026-121600"]
title: "TOTOLINK A950RG router: remote stack overflow in MAC filter handler"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "A950RG firmware", "fixed": [], "affected": "4.1.2cu.5268_B20221104", "ecosystem": "vendor"}]
ecosystems: []
tags: ["a950rg", "embedded-firmware", "home-router", "infrastructure", "totolink"]
not_affected_if: ["admin-interface-not-reachable", "other-firmware-version"]
published_at: "2026-11-04T01:17:23+00:00"
first_seen_at: "2026-11-04T01:45:48+00:00"
updated_at: "2026-11-04T01:47:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121600", "first_seen_at": "2026-11-04T01:45:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T01:47:42+00:00"}]
---

# TOTOLINK A950RG router: remote stack overflow in MAC filter handler

The TOTOLINK A950RG router firmware has a stack-based buffer overflow in the setMacFilterRules function of its web CGI interface, triggered through the addEffect argument. A public exploit exists, so a remote attacker could likely run code on the router.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:A950RG firmware affected 4.1.2cu.5268_B20221104 fixed ?

## How to check

- Log in to the router admin page and read the firmware version; the affected build is 4.1.2cu.5268_B20221104
- Check whether the admin interface (port 80) is reachable from the internet or untrusted networks, and turn off remote management if so
- Also check other TOTOLINK models and builds you run; sibling handlers in the same cstecgi.cgi have had similar reports

## Timeline

- 2026-11-04T01:45:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121600
- 2026-11-04T01:47:42+00:00 analyst — Only NVD/VulDB-derived record found; no TOTOLINK advisory or fixed firmware located, no public PoC page found for this CVE (so poc_count stays 0). CVSS 4.0 vector from VulDB has PR:L, suggesting login is needed, but not confirmed by any source. Nothing marked verified.

## Documents

- [describes] NVD CVE-2026-121600 https://nvd.nist.gov/vuln/detail/CVE-2026-121600

## From the sources

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_